GCVE-110-OSM-2026-13947

APT malware detected: PolinRider, TasksJacker. Associated with threat actor(s): DPRK/Lazarus. Behaviors: obfuscated code. ENTRY index.js (main: index.js) OBFUSCATION - Obfuscation: function to array replacements in lib/contract.js - Obfuscation (osm-deobfuscator): unknown in lib/contract.js - Strings Extracted from Deobfuscated Code in lib/contract.js - Obfuscation patterns: underscoreDollarVars, splitJoinChain in lib/contract.js ADDITIONAL FINDINGS - Campaign marker: PolinRider in [deobfuscated] lib/contract.js: "global['_V']" - Campaign marker: TasksJacker in [deobfuscated] lib/contract.js: "2[gWfGj;<:-93Z^C" - Brand New Package - Very New NPM Publisher Account - Rapid Version Publishing PAYLOAD FILES [deobfuscated] lib/contract.js (+ lib/contract.js)